News

Microsoft Blocks Lebanon-Based Hackers Targeting Israel

The hackers were abusing Microsoft’s file hosting service, OneDrive, to target private and government organizations in Israel.

Published

4 years ago

June 7, 2022

David Morelo

microsoft blocks lebanon-based hackers targeting israel

Microsoft Threat Intelligence Center (MSTIC) has successfully identified and disabled an attack orchestrated by a Lebanon-based activity group called Polonium.

The group was abusing Microsoft’s file hosting service, OneDrive, to target private and government organizations in Israel. Based on its tools and techniques, it seems that Polonium is affiliated with Iran’s Ministry of Intelligence and Security (MOIS).

“Polonium has targeted or compromised more than 20 organizations based in Israel and one intergovernmental organization with operations in Lebanon over the past three months,” explains MSTIC.

The good news is that all legitimate OneDrive accounts are completely safe because the attack didn’t involve any security issues or vulnerabilities. Instead, Polonium used the file hosting service for command and control to execute part of their attack operation.

Polonium’s targets include primarily organizations in critical manufacturing, IT, and defense industry. “In at least one case, Polonium’s compromise of an IT company was used to target a downstream aviation company and law firm in a supply chain attack that relied on service provider credentials to gain access to the targeted networks.”

MSTIC is still actively investigating how Polonium gained initial access to many of their victims, but it knows that most victims were running Fortinet appliances. Based on this fact, MSTIC suspects that the CVE-2018-13379 vulnerability was used to gain access inside the targeted organizations.

Also Read: Is Your Phone Hacked? How To Find Out & Protect Yourself

While the threat has been contained, there are certain actions MSTIC recommends all organizations to take to protect themselves, such as confirming that Microsoft Defender Antivirus is updated, enabling multi-factor authentication (MFA), and blocking in-bound traffic from specific IP addresses.

This isn’t the first instance of threat actors using OneDrive and other similar file hosting services to achieve their nefarious goals. Last year, for example, Microsoft discovered that OneDrive was used to host malware files commonly used to launch Conti ransomware attacks.

News

ESET Bets On Specialized Security AI At 0.5% The Training Cost

ESET says NeoCortex can estimate an attacker’s next move, with a kill switch and human oversight built in to keep it from going rogue.

Published

5 days ago

November 4, 2026

Dana Saadeh

eset bets on specialized security ai at 0.5% the training cost

A sign-in anomaly, a suspicious process launch and an unusual connection may look harmless alone. Together, they can describe an intrusion that is hard for security to teams to piece together.

To solve that problem, ESET announced ESET NeoCortex on November 4, 2026: a specialized foundational AI model for cybersecurity. It powers ESET LiveCortex, available within the ESET PROTECT Platform, which connects fragmented security signals and turns them into actionable incidents.

Filtering is the main selling point, with LiveCortex processing billions of raw telemetry events daily, and just 0.00111% of them contributing to incidents presented to customers. The aim is less alert fatigue and more analyst time spent on threats that matter.

NeoCortex is built on world-model architecture, learning how digital environments behave and how events relate. ESET says that lets it reconstruct missing incident context, recognize similar past cases and estimate an attacker’s likely next step – what the company calls “minus-one-day defense,” a chance to intervene before the next stage unfolds. ESET points to Black October, the week leading up to October 25, 2026, when critical security issues affecting PHP, Linux, GitLab and other key systems demanded rapid, prioritized responses, as the kind of moment where that context matters.

ESET’s internal research also suggests a specialized model like NeoCortex can be trained at up to 200 times lower cost than a large general reasoning model, while delivering more accurate, defense-focused results. The company credits optimized training, a focus on cybersecurity vocabulary, lower computing requirements and privately owned hardware.

Also Read: Dubai Says Its Deepfake Detector Needs Just 7 Seconds Of Video

“AI is accelerating both cyberattacks and cyberdefenses. With ESET NeoCortex, we are applying our AI investment to develop specialized foundational cybersecurity intelligence that remains under our control and strengthens, rather than replaces, human expertise,” said Juraj Malcho, Chief Technology Officer at ESET.

As part of the design, NeoCortex forms part of a layered architecture combining specialized models, deterministic controls, correlation logic, validation, auditability and expert human oversight. Safeguards include restricted sandboxes, read-only tools, continuous monitoring, defined usage and token limits, a kill switch and human oversight of critical response decisions. The model is also developed and self-hosted on ESET’s own infrastructure, which the company says reduces exposure to shifts among third-party AI providers, including commercial and geopolitical ones.